Is CVE-2026-1709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1709 being exploited in the wild.

How severe is CVE-2026-1709?

Critical severity, with a CVSS score of 9.4, published 6 February 2026.

Which products and versions are affected?

keylime (PyPI) ECOSYSTEM:introduced=0,fixed=7.12.0, ECOSYSTEM:introduced=7.12.0,fixed=7.12.2.

Is there a fix for CVE-2026-1709?

Yes. keylime (PyPI): upgrade to 7.12.0, 7.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1709 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1709?

Check whether you run keylime (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1709: Keylime authentication bypass in registrar component

CVE-2026-1709 · Severity: critical · CVSS 9.4 · Published 2026-02-06

Keylime, a security tool used to verify the integrity of remote computers using hardware-based trust, contains a flaw where it fails to properly check the identity of connecting clients. This allows an unauthorized person on the network to bypass security controls and perform administrative tasks, such as deleting registered devices or accessing sensitive hardware security data. This could lead to a loss of trust in the monitored infrastructure or a disruption of security monitoring services.

Technologies: keylime (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-1709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1709 being exploited in the wild.
How severe is CVE-2026-1709?: Critical severity, with a CVSS score of 9.4, published 6 February 2026.
Which products and versions are affected?: keylime (PyPI) ECOSYSTEM:introduced=0,fixed=7.12.0, ECOSYSTEM:introduced=7.12.0,fixed=7.12.2.
Is there a fix for CVE-2026-1709?: Yes. keylime (PyPI): upgrade to 7.12.0, 7.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1709 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1709?: Check whether you run keylime (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keylime (PyPI): upgrade to 7.12.0, 7.12.2 or later
```
pip install "keylime>=7.12.2"
```

Technical details

An authentication bypass vulnerability exists in the Keylime registrar component starting with version 7.12.0. The root cause is the failure to enforce client-side Transport Layer Security (TLS) authentication, which is intended to verify the identity of connecting clients via certificates. A remote, unauthenticated attacker can connect to the registrar without presenting a valid client certificate to perform administrative actions such as listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents. Red Hat has released security updates for Enterprise Linux 9 and 10 to address this issue.

Affected products

Keylime Project Keylime >= 7.12.0, < 7.12.1-11.el9_7.4 (RHEL 9), < 7.12.1-11.el10_1.4 (RHEL 10)
Red Hat Corportation Enterprise Linux 9, 10

Identifiers

CVE-2026-1709
GHSA-4jqp-9qjv-57m2
PYSEC-2026-74

Timeline

2026-02-06: disclosed
2026-02-09: patched: Red Hat released security updates RHSA-2026:2224 and RHSA-2026:2225

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.